Splitting json in logstash pipeline

Question

I am getting data in below format from one URL configured in logstash pipeline -

"_source": {
    "result": {
      "incident_state": "-5",
      "u_agent_name": "",
      "number": "XXXXX",
      "time_worked": "",
      "problem_id": "",
      "cause": "",
      ""assigned_to": {
        "link": "xyz.com",
        "value": "40b4f5df"
      }
    }
  }

and I want it to split like below -

    "_source": {
      "incident_state": "-5",
      "u_agent_name": "",
      "number": "XXXXX",
      "time_worked": "",
      "problem_id": "",
      "cause": "",
      ""assigned_to": {
        "link": "xyz.com",
        "value": "40b4f5df"
      }
   }

As I am new to it, I am stuck here badly and existing similar questions from stack overflow are not helpful or me. Kindly help me to achieve this. Thank you so much in advance.

Answer 1

I recommend you to use json filter of logstash.

https://www.elastic.co/guide/en/logstash/current/plugins-filters-json.html

filter {
  # Split the "result" field into multiple objects, one for each key-value pair.
  json {
    source => "result"
    target => "_source"
  }
}

You can also use mutate, add field, rename fields. They are very useful.